CVE-2024-52325: ECOVACS robot lawnmowers and vacuums command injection

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-01-23 · updated 2026-06-17
Weakness: CWE-77

Description

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.

Affected products

ECOVACS Deebot T30 Omni Firmware: before 1.93.0 — fixed in 1.93.0
ECOVACS Deebot T30S Firmware: before 1.95.0 — fixed in 1.95.0
ECOVACS Deebot X2 Combo Firmware: before 1.81.10 — fixed in 1.81.10
ECOVACS Deebot X2 Omni Firmware: before 1.76.6 — fixed in 1.76.6
ECOVACS Deebot X2S Firmware: before 1.49.0 — fixed in 1.49.0
ECOVACS Deebot X5 Pro Firmware: before 1.70.0 — fixed in 1.70.0
ECOVACS Deebot X5 Pro Plus Firmware: before 1.38.0 — fixed in 1.38.0
ECOVACS Deebot X5 Pro Ultra Firmware: before 1.17.0 — fixed in 1.17.0
ECOVACS Goat G1-2000 Firmware: before 1.36.187 — fixed in 1.36.187
ECOVACS Goat G1-800 Firmware: before 1.36.187 — fixed in 1.36.187
ECOVACS Goat G1 Firmware: before 1.36.187 — fixed in 1.36.187
ECOVACS Gx-600 Firmware: before 1.2.120 — fixed in 1.2.120

How to fix

Upgrade to a fixed version: ECOVACS Deebot T30 Omni Firmware 1.93.0; ECOVACS Deebot T30S Firmware 1.95.0; ECOVACS Deebot X2 Combo Firmware 1.81.10; ECOVACS Deebot X2 Omni Firmware 1.76.6; ECOVACS Deebot X2S Firmware 1.49.0; ECOVACS Deebot X5 Pro Firmware 1.70.0; ECOVACS Deebot X5 Pro Plus Firmware 1.38.0; ECOVACS Deebot X5 Pro Ultra Firmware 1.17.0; ECOVACS Goat G1-2000 Firmware 1.36.187; ECOVACS Goat G1-800 Firmware 1.36.187; ECOVACS Goat G1 Firmware 1.36.187; ECOVACS Gx-600 Firmware 1.2.120. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-52325 or the next vulnerability affects your stack